How to List All Connected SSH Sessions on Linux

Introduction

Secure Shell (SSH) is a commonly used protocol for secure remote access to Linux servers. When multiple users are connected to a Linux server via SSH, it can be useful to list all connected SSH sessions for administrative or monitoring purposes. In this article, we will discuss how to list all connected SSH sessions on Linux using various command line tools.

List of SSH sessions connected with the who command

The who command is a simple and widely available command-line tool for listing logged in users on a Linux system. To list all connected SSH sessions, you can use the “who -a” command. The -a option shows all users, including those who are not logged in through the system console. The result will show your username, terminal, and login date and time.

$ who -a
root     pts/0        2020-12-19 14:20 (10.0.0.1)
user1    pts/1        2020-12-19 15:25 (10.0.0.2)
user2    pts/2        2020-12-19 14:30 (10.0.0.3)

In this example, the output shows that there are three users currently connected: "root", "user1" and "user2", along with the endpoint they connected to and the IP addresses they connected from.

List of SSH sessions connected with the w command

Another command-line tool that can be used to list connected SSH sessions is “w”. This command displays information about users currently logged on to the system, and also displays the process each user is running. To list all connected SSH sessions, you can use the “w -h” command, which omits the header and shows only the process.

$ w -h
root     pts/0        14:20   2.00s  0.00s  ssh 10.0.0.1
user1    pts/1        14:25   1.00s  0.00s  ssh 10.0.0.2
user2    pts/2        14:30   1.00s  0.00s  ssh 10.0.0.3

In this example, the output shows that the three users are currently connected, the terminal they are connected to, and the IP addresses they are connecting from.

List of SSH sessions connected with the last command

The last command is used to display users who have recently logged on to the system. This command can also be used to list connected SSH sessions using the latest “-i” command.

$ last -i
root     pts/0        10.0.0.1       Sun Dec 19 14:20 - 14:25  (00:05)
user1    pts/1        10.0.0.2       Sun Dec 19 14:25 - 14:30  (00:05)
user2    pts/2        10.0.0.3       Sun Dec 19 14:30 - 14:35  (00:05)

In this example, the output shows the three users currently connected, the endpoint they connected to, the IP addresses they connected from, and the length of their session.

List of SSH sessions connected with the who -u command

You can also use the “who -u” command to list all connected SSH sessions. This command displays the user, terminal, and login date and time.

$ who -u
root     pts/0        2020-12-19 14:20 (10.0.0.1)
user1    pts/1        2020-12-19 14:25 (10.0.0.2)
user2    pts/2        2020-12-19 14:30 (10.0.0.3)

The “-u” option shows users and their idle time, but does not show IP addresses. So, if IP information is important to you, you can combine this command with the “-i” option which will show the IP addresses.

$ who -u -i
root     pts/0        2020-12-19 14:20 (10.0.0.1) . . . . . . . . . . . . . . . 
user1    pts/1        2020-12-19 14:25 (10.0.0.2) . . . . . . . . . . . . . . . 
user2    pts/2        2020-12-19 14:30 (10.0.0.3) . . . . . . . . . . . . . . .

List of SSH sessions connected with the ss command

Another command that can be used to list connected SSH sessions is ss. This command is similar to netstat but more efficient and is used to dump socket statistics. To list all connected SSH sessions, you can use the “ss -t -a” command.

$ ss -t -a | grep ssh
tcp    ESTAB      0      0      10.0.0.1:ssh      10.0.0.1:46754        users:(("sshd",pid=9987,fd=3))
tcp    ESTAB      0      0      10.0.0.2:ssh      10.0.0.2:47754        users:(("sshd",pid=9987,fd=3))
tcp    ESTAB      0      0      10.0.0.3:ssh      10.0.0.3:48754        users:(("sshd",pid=9987,fd=3))

The “-t” option shows only TCP connections and the “-a” option shows all sockets. The grep command is used to filter the output and shows only ssh connections.

Conclusion

In this article, we have discussed several command-line tools for listing connected SSH sessions on Linux. Each command has its own specific options and output format, so it's up to you to choose the one that best suits your needs. It is always recommended to consult the man pages of each command before using it, to ensure that you are using the correct options and getting the expected result.